The GDPR does not allow or forbid scraping of personal data. That's processing of personal data just like other processing activities, and requires that the data controller has a suitable legal basis for this processing. It doesn't matter if the personal data was made public, though that might influence a balancing test if the legal basis is a legitimate interest.
In this scenario, the purpose of processing seems to be marketing. I doubt that there will be a suitable legal basis other than (informed, freely given) consent. While marketing can be a legitimate interest of a business, there are further rules in the EU for how that can be done. For example, practices like sending unsolicited emails to scraped addresses or cold calling is quite illegal.
However, it is not clear to me who the data controller is in this scenario. Clearly, your customer is a data controller since they determine the purposes of processing. But I'm not sure there is a meaningful difference between performing a processing activity and just preparing everything that is necessary other than the final step of actually executing the tool. Therefore, you might be a joint data controller as well, though I'm really not sure about this. If you are a data controller, it is extremely unlikely you'd be able to do this in a GDPR-compliant manner.